netdev - Re: [PATCH bpf-next] bpf: extend BTF_ID_LIST_GLOBAL with parameter for number of IDs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iJ4r10f0375hoGC-227AWTEqJop88qEZRhOinxQWn7oKw@mail.gmail.com>
Date:   Wed, 10 Nov 2021 09:48:11 -0800
From:   Eric Dumazet <edumazet@...gle.com>
To:     Song Liu <songliubraving@...com>
Cc:     bpf@...r.kernel.org, netdev@...r.kernel.org, ast@...nel.org,
        daniel@...earbox.net, andrii@...nel.org, Kernel-team@...com,
        syzbot+e0d81ec552a21d9071aa@...kaller.appspotmail.com
Subject: Re: [PATCH bpf-next] bpf: extend BTF_ID_LIST_GLOBAL with parameter
 for number of IDs

On Wed, Nov 10, 2021 at 9:45 AM Song Liu <songliubraving@...com> wrote:
>
> syzbot reported the following BUG w/o CONFIG_DEBUG_INFO_BTF
>
> BUG: KASAN: global-out-of-bounds in task_iter_init+0x212/0x2e7 kernel/bpf/task_iter.c:661
> Read of size 4 at addr ffffffff90297404 by task swapper/0/1
>
...
>
> This is caused by hard-coded name[1] in BTF_ID_LIST_GLOBAL (w/o
> CONFIG_DEBUG_INFO_BTF). Fix this by adding a parameter n to
> BTF_ID_LIST_GLOBAL. This avoids ifdef CONFIG_DEBUG_INFO_BTF in btf.c and
> filter.c.
>
> Fixes: 7c7e3d31e785 ("bpf: Introduce helper bpf_find_vma")
> Reported-by: syzbot+e0d81ec552a21d9071aa@...kaller.appspotmail.com
> Suggested-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: Eric Dumazet <edumazet@...gle.com>
> Signed-off-by: Song Liu <songliubraving@...com>
> ---
>  include/linux/btf_ids.h | 6 +++---
>  kernel/bpf/btf.c        | 2 +-
>  net/core/filter.c       | 6 +-----
>  3 files changed, 5 insertions(+), 9 deletions(-)

SGTM, thanks !

Reviewed-by: Eric Dumazet <edumazet@...gle.com>